PT-2025-49335 · WordPress · Wordpress List Attachments Shortcode
CVE-2025-12717
·
Publicado
2025-12-06
·
Atualizado
2025-12-06
CVSS v3.1
6.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
WordPress List Attachments Shortcode plugin versions through 0.4.1a
Description
The List Attachments Shortcode plugin for WordPress has a Stored Cross-Site Scripting issue. This is due to insufficient input sanitization and output escaping in the
before list parameter of the [list-attachments] shortcode. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.Recommendations
Update the WordPress List Attachments Shortcode plugin to a version later than 0.4.1a.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wordpress List Attachments Shortcode